Bermuda based Appleby has admitted there has been a breach earlier this year but did not disclose exactly when.

It all smells very much like the 2015 Panama Papers case and the UK’s Daily Telegraph said the exposed information could place a high amount of scrutiny on various tax havens used by the rich.

The International Consortium of Investigative Journalists (ICIJ) approached Appleby’s and made unspecified allegations against the company after viewing the exposed documents.

ICIJ is known for publishing the Panama Papers, so we can expect another firestorm.

In a statement Appleby said, “Appleby has thoroughly and vigorously investigated the allegations and we are satisfied that there is no evidence of any wrongdoing, either on the part of ourselves or our clients. We refute any allegations which may suggest otherwise and we would be happy to cooperate fully with any legitimate and authorised investigation of the allegations by the appropriate and relevant authorities.

“We are disappointed that the media may choose to use information which could have emanated from material obtained illegally and that this may result in exposing innocent parties to data protection breaches.”

Despite acknowledging the breach Appleby said it had “reviewed its cybersecurity and data access arrangements and is confident that its data integrity is secure.”

I am not too sure their clients will share that same level of confidence!

So why do these breaches keep happening? Digital Guardian were asked this question and this is what they said:

“All we are able to do, all that’s been done, is to build a massive perimeter defense that guarantees only authorized people will gain access. The problem here is that attackers steal authorization credentials. So to these defenses, the attackers still appear authorized. Perimeter network defenses are completely blind to the fact this person is a bad actor.

“It’s a lot like this scenario: you’re building a bank and you invest your security budget into reinforcing the perimeter walls, exterior security cameras, security guards, alarms, etc. People must pass your guard gate and show their credentials before being admitted. They finally enter and find all the money piled on the floor. They can take whatever they want and walk right out the door because they are authorized. That’s basically the present state of data protection at the majority of companies.

“Some organizations are using specialized software tools called Data Loss Prevention, or DLP, that are supposed to protect valuable company data. DLP software looks at files being sent off the network and tries to determine if they are sensitive. If it’s determined that they are sensitive and the action is risky, then the operation will be cancelled. That’s one for the good guys!

“Unfortunately, attackers have learned to adapt to traditional DLP software. Going back to our bank example: if the company had deployed a DLP solution it would be a lot like a security guard approaching you as you try to exit the building. They see that you’re carrying money and they stop you. You’re caught. But what if you stuff the money in your pocket? These traditional DLP guards don’t see it and you’re able to walk out.

“Why don’t the traditional data loss prevention guards see the money you hid in your pocket? Because cyber attackers encrypt the sensitive data they are looking for and send it out of your enterprise without you being able to see that it was sensitive data. That is just like stuffing the money in your pockets and exiting the bank without incident. Traditional DLP tools cannot fully address this problem and that is why we see so many public breaches. And many of the current headline breaches had these traditional DLP tools in place.”

Digital Guardian say they have the answer. Go to: https://digitalguardian.com/blog/why-do-cyber-attacks-keep-happening

Pity then Equifax didn’t sign up.

The major problem says RICHARD FORNO in THE CONVERSATION that “several major problems need to be addressed before people can live in a truly secure society: For example, companies must find and hire the right people to actually solve the overall problems and think innovatively rather than just fixing the day-to-day issues. Companies must be made to get serious about cybersecurity — at a time when many firms have financial incentives not to, also. Until then, major breaches will keep happening and may get even worse.

“Data breaches are commonplace now, and have widespread effects. The Equifax breach affected more than 143 million people — far more than than the 110 million victims in 2013 at Target, the 45 million TJX customers hit in 2007, and significantly more than the 20 million or so current and former government employees in the 2015 U.S. Office of Personnel Management incident. Yahoo’s 2016 loss of user records, with a purported one billion victims, likely holds the dubious record for most victims in a single incident.”

Appleby, however, are confident that its data integrity is secure. Is that why they told no one they had been breached as soon as it happened?